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Foreword 


ISO (the International Organization for Standardization) and IEC (the International Electrotechnical 
Commission) form the specialized system for worldwide standardization. National bodies that are 
members of ISO or IEC participate in the development of International Standards through technical 
committees established by the respective organization to deal with particular fields of technical 
activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international 
organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the 
work. In the field of conformity assessment, ISO and IEC develop joint ISO/IEC documents under the 
management of the ISO Committee on Conformity assessment (ISO/CASCO). 


The procedures used to develop this document and those intended for its further maintenance are 
described in the ISO/IEC Directives, Part 1. In particular the different approval criteria needed for the 
different types of ISO documents should be noted. This document was drafted in accordance with the 
editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives). 


Attention is drawn to the possibility that some of the elements of this document may be the subject 
of patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent 
rights. Details of any patent rights identified during the development of the document will be in the 
Introduction and/or on the ISO list of patent declarations received (see www.iso.org/patents). 


Any trade name used in this document is information given for the convenience of users and does not 
constitute an endorsement. 


For an explanation on the voluntary nature of standards, the meaning of ISO specific terms and 
expressions related to conformity assessment, as well as information about ISO's adherence to the 
World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT) see the following 
URL: www.iso.org/iso/foreword.html. 


This document prepared by Project Committee ISO/PC 283, Occupational health and safety management 
systems, and the ISO Committee on conformity assessment (CASCO). It was circulated for voting to the 
national bodies of both ISO and IEC, and was approved by both organizations. 


A list of all parts in the ISO/IEC 17021 series can be found on the ISO website. 
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Introduction 


ISO 45001 provides a framework to enable organizations to provide safe and healthy workplaces by 
preventing work-related injury and/or ill health to workers as well as by proactively improving its 
occupational health and safety (OH&S) performance. OH&S management system certification personnel 
need to have competencies described in ISO/IEC 17021-1:2015, as well as specific OH&S management 
system competencies described in this document. 


This document complements the requirements in ISO/IEC 17021-1:2015, including the guiding principles 
in ISO/IEC 17021-1:2015, Clause 4. In particular, it clarifies the requirements for the competence of 
personnel involved in the certification process set out in ISO/IEC 17021-1:2015, Annex A. 


Certification bodies have a responsibility to interested parties, including their clients and the customers 
of the organizations whose management systems are certified, to ensure that OH&S management 
system certification is credible by only using certification personnel that have demonstrated 
relevant competence. 


In this document, the following verbal forms are used: 
— “shall” indicates a requirement; 

— “should” indicates a recommendation; 

— “may” indicates a permission; 

— “can” indicates a possibility or a capability. 


Further details can be found in the ISO/IEC Directives, Part 2. 
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Conformity assessment — Requirements for 
bodies providing audit and certification of 
management systems — 


Part 10: 
Competence requirements for auditing and certification of 
occupational health and safety management systems 


1 Scope 


This document specifies additional competence requirements for personnel involved in the audit 
and certification process for an occupational health and safety (OH&S) management system and 
complements the existing requirements of ISO/IEC 17021-1. 


Three types of personnel and certification functions are defined: 

— auditors; 

— personnel reviewing audit reports and making certification decisions; 

— other personnel. 

NOTE This document is applicable for auditing and certification of an OH&S management system based on 
ISO 45001. It can also be used for other OH&S applications. 

2 Normative references 


The following documents are referred to in the text in such a way that some or all of their content 
constitutes requirements of this document. For dated references, only the edition cited applies. For 
undated references, the latest edition of the referenced document (including any amendments) applies. 


ISO/IEC 17021-1:2015, Conformity assessment — Requirements for bodies providing audit and certification 
of management systems — Part 1: Requirements 


ISO 45001, Occupational health and safety management systems — Requirements with guidance for use 


3 Terms and definitions 


For the purposes of this document, the terms and definitions given in ISO/IEC 17021-1 and 
ISO 45001 apply. 


ISO and IEC maintain terminological databases for use in standardization at the following addresses: 


— ISO Online browsing platform: available at https://www.iso.org/obp 


— IEC Electropedia: available at http://www.electropedia.org/ 


3.1 

occupational health and safety technical area 

OH&S technical area 

area characterized by commonalities of processes relevant to an occupational health and safety 
management system and its intended results 
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4 Competence requirements 


The certification body shall define the competence requirements for each certification function as 
referenced in ISO/IEC 17021-1:2015, Table A.1. When defining these competence requirements, the 
certification body shall take into account all the requirements specified in ISO/IEC 17021-1, as well as 
the competence requirements specified in Clauses 5, 6 and 7 of this document, including those that 
are relevant for the OH&S technical area as defined by the certification body. Unless otherwise stated, 
the OH&S competence criteria mentioned in Clauses 5, 6 and 7 are independent of any OH&S technical 
area. Annex À provides a summary of the knowledge for OH&S management system auditing and 
certification. 


NOTE The role of an auditor is not the same as that of a work inspector. 


5 Competence requirements for OH&S management system auditors 


5.1 General 


An audit team shall be composed of auditors (and technical experts, as necessary) having the collective 
competence to undertake the audit. 


Each OH&S management system auditor shall have knowledge of the synergy within an OH&S 
management system and how its processes interact to meet its intended outcomes of providing a safe 
and healthy workplace and the prevention of injury and ill health. 


NOTE It is not necessary for each member of the audit team to have the same competence, however, the 
collective competence of the audit team needs to be sufficient to achieve the audit objectives. 


5.2 Terminology, principles, processes and concepts of OH&S 


Each OH&S management system auditor shall have and maintain up-to-date knowledge of terminology, 
principles, processes and concepts of OH&S and OH&S management. 


Terminology, principles, processes and concepts of OH&S and OH&S management include, but are 
not limited to: 


— intended outcome(s) of the OH&S management system; 
— hazards and OH&S risks; 

— minimizing or reducing risks; 

— hierarchy of control; 

— procurement (including outsourcing and contractors); 


— shared control over work performed. 


5.3 Context of the organization 


In order to determine that an organization has appropriately identified the scope, including boundaries 
and applicability ofits OH&S management system, within the organization's context and its work related 
activities, personnel on a team involved in OH&S management system auditing shall have knowledge of: 


— potential issues relevant to the context of an organization, in order to determine whether the 
organization has identified external and internal issues that can affect the organization's ability to 
achieve the intended outcome(s) of its OH&S management system; 


— potential other interested parties in addition to workers, in order to determine if an organization 
has identified the relevant needs and expectations of workers and other interested parties. 
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5.4 Leadership, consultation and participation of workers 


Personnel on a team involved in OH&S management system auditing shall have knowledge of the role 
and impact of leadership and culture on an organization. This knowledge shall be applied to evaluate 
whether the top management of an organization is demonstrating its commitment to the OH&S 
management system and achieving its intended outcome(s). 


Personnel on a team involved in OH&S management system auditing shall have knowledge of 
methodologies for consultation and participation, including obstacles and barriers, in order to 
determine whether an organization has effective processes for consultation and participation of 
workers and, when they exist, workers’ representatives. 


5.5 Legal requirements and other requirements 


Personnel on a team involved in OH&S management system auditing shall have knowledge of legal 
requirements and other requirements in the field of health and safety at work, including those relevant 
to the OH&S technical area, in order to evaluate whether an organization has a process to determine, 
apply and periodically review its legal requirements and other requirements, including those related to: 


— consultation and participation of workers and workers’ representatives, where they exist; 
— the privacy of personal medical information; 


— establishment of health and safety committees. 
5.6 OH&S risks, OH&S opportunities and other risks and other opportunities 


5.6.1 Risks and opportunities 


Personnel on a team involved in OH&S management system auditing shall have knowledge of risks and 
opportunities, including those relevant to the OH&S technical area, in order to evaluate whether an 
organization has applied appropriate methods for identifying hazards and determining OH&S risks, 
OH&S opportunities and other risks and other opportunities in an organizational context and within 
the scope of the OH&S management system. 


NOTE Examples of relevant methods and criteria for determining risks and opportunities can include 


qualitative and quantitative analysis such as task analysis, hazard and operability studies (HAZOPS) and failure 
mode and effects analysis (FMEA). 


5.6.2 Hazard identification 


Personnel on a team involved in OH&S management system auditing shall have knowledge of hazards, 
including those relevant to the OH&S technical area, in order to evaluate whether an organization has 
applied appropriate methods for identifying hazards in an organizational context and within the scope 
of the OH&S management system. 


Knowledge of hazards shall include, but not be limited to, those in the following categories: 
— physical; 

— chemical; 

— biological; 

— physiological; 

— mechanical; 

— electrical; 


— psychosocial; 
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— based on movement and energy. 

Knowledge of hazards and their sources shall include, but not be limited to: 
— internal or external sources or situations; 

— potential emergency situations; 

— multi-employer workplaces; 

— workplace and facility; 


— product and service design, research, development, testing, production, assembly, construction, 
service delivery, maintenance and disposal; 


— procurement, contractors and outsourcing; 
— new technologies and their application; 
— planned or unintended changes; 


— work organization, human and social factors. 


5.6.3 Assessment of OH&S risks 


Personnel on a team involved in OH&S management system auditing shall have knowledge of the 
methodologies and criteria for the identification of hazards and the assessment of OH&S risks, including 
those relevant to the OH&S technical area, in order to evaluate whether an organization has applied 
methodologies and criteria in an appropriate, proactive and systematic way in an organizational 
context and within the scope of the OH&S management system. 


5.6.4 OH&S opportunities 


Personnel on a team involved in OH&S management system auditing shall have knowledge of the type 
of processes that can lead to improvement of OH&S performance. 


Knowledge of processes shall include but not be limited to: 
— adapting work to workers; 
— changing the work organization; 


— changing the workplace layout. 


5.7 Emergency preparedness and response 


Personnel on a team involved in OH&S management system auditing shall have knowledge of potential 
emergency situations and their usual responses, including those relevant to the OH&S technical area in 
an organizational context, in order to evaluate whether an organization has appropriately: 


— identified its potential emergency situations; 
— planned and tested its emergency responses, including with respect to external responders; 


— evaluated its effectiveness in testing its planned emergency responses and responses given to 
actual emergencies, if applicable. 


5.8 Performance evaluation 


Personnel onateam involved in OH&S management system auditing shall have knowledge of performance 
evaluation in order to evaluate whether an organization has applied appropriate OH&S performance 
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evaluation methods, including proactive and reactive, qualitative and quantitative indicators, and to 
determine whether it is achieving the intended outcome(s) of its OH&S management system. 


5.9 Eliminating hazards and reducing OH&S risks 


Personnel on a team involved in OH&S management system auditing shall have knowledge of the 
control measures or control methods used to eliminate hazards and reduce OH&S risks, including those 
relevant to the OH&S technical area, in order to evaluate whether an organization has applied: 


— the concept of the hierarchy of control, including adapting work to workers and its appropriate 
application; 


— the appropriate and effective control measures, including the identification of any potential adverse 
effects, that have been selected by the organization, including those applied to the external providers. 


5.10 Incident investigation 


Personnel on a team involved in OH&S management system auditing shall have knowledge of incident 
investigation methods, including those relevant to the OH&S technical area, in order to evaluate 
whether an organization has conducted the investigation effectively in an organizational context and 
within the scope of the OH&S management system. This includes: 


— the relevant methods and practices for incident investigations, such as root cause analysis, fault 
tree analysis; 


— the identification of actions to eliminate the cause(s). 


6 Competence requirements for personnel reviewing audit reports and making 
certification decisions 
6.1 Terminology, principles, processes and concepts of OH&S 


Personnel reviewing audit reports and making certification decisions shall have and shall maintain up- 
to-date knowledge of terminology, principles, processes and concepts of OH&S and OH&S management. 


Terminology, principles and concepts of OH&S and OH&S management include, but are not limited to: 
— intended outcome(s) of the OH&S management system; 

— hazards and OH&S risks; 

— minimizing or reducing risks; 

— hierarchy of control; 

— procurement (including outsourcing and contractors); 


— shared control over work performed. 


6.2 Context of the organization 


Personnel reviewing audit reports and making certification decisions shall have sufficient knowledge 
of the following in order to determine if the audit team has appropriately confirmed the scope, including 
boundaries and applicability of its OH&S management system, within the organization's context and its 
work related activities: 


— potential issues relevant to the context of the organization; 


— potential other interested parties. 
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6.3 Leadership, consultation and participation of workers 


Personnel reviewing audit reports and making certification decisions shall have knowledge of the 
role and impact of leadership, culture, consultation and participation of workers and, when they exist, 
workers’ representatives. 


6.4 Legal requirements and other requirements 


Personnel reviewing audit reports and making certification decisions shall be aware of legal 
requirements and other requirements in the field of health and safety at work. 


6.5 OH&S risks, OH&S opportunities and other risks and other opportunities 


6.5.1 Hazard identification 


Personnel reviewing audit reports and making certification decisions shall have knowledge of hazards 
and methods for identifying them, including those relevant to the OH&S technical area. 


Personnel reviewing audit reports and making certification decisions shall have knowledge of the 
following categories of hazards, including but not limited to, those in the following categories: 


— physical; 

— chemical; 

— biological; 

— physiological; 

— mechanical; 

— electrical; 

— psychosocial; 

— based on movement and energy. 

6.5.2 Assessment of OH&S risks 

Personnel reviewing audit reports and making certification decisions shall have knowledge of the type 


of methodologies and criteria for the assessment of OH&S risks, including those relevant to the OH&S 
technical area. 


6.5.3 OH&S opportunities 


Personnel reviewing audit reports and making certification decisions shall be aware of concepts of 
OH&S opportunities. 


6.6 Performance evaluation 


Personnel reviewing audit reports and making certification decisions shall have knowledge of OH&S 
performance evaluation methods. 


6.7 Eliminating hazards and reducing OH&S risks 


Personnel reviewing audit reports and making certification decisions shall have knowledge of the 
concept of the hierarchy of control. 
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6.8 Incident investigation 


Personnel reviewing audit reports and making certification decisions shall have knowledge of incident 
investigation methods. 


7 Competence requirements for other certification personnel 


7.1 Terminology, principles, processes and concepts of OH&S 


As appropriate for their function, personnel conducting the application review to determine the audit 
team competence required, to select the audit team members, and to determine the audit time, shall 
have and shall maintain up-to-date knowledge of OH&S terminology, principles, processes and concepts. 


Terminology, principles, processes and concepts of OH&S and OH&S management include, but are 
not limited to: 


— intended outcome(s) of the OH&S management system; 
— hazards and OH&S risks; 

— minimizing or reducing risks; 

— hierarchy of control; 

— procurement (including outsourcing and contractors); 


— shared control over work performed. 


7.2 Context of the organization 


As appropriate for their function, personnel conducting the application review to determine the 
audit team competence required, to select the audit team members, and to determine the audit 
time, shall have: 


— knowledge of site-related factors, and risks and complexity related to the site and the organization’s 
activities, to determine the audit time and to select a competent audit team; 


— knowledge to determine that the proposed scope of certification is appropriate within the 
organization’s context and its work related activities. 
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Annex À 
(informative) 


Knowledge for OH&S management systems auditing and 
certification 


Table A.1 provides a summary of the knowledge required for OH&S management systems auditing and 


certification. 


Table A.1 — Knowledge for OH&S management system auditing and certification 


Knowledge 


OH&S terminology, 
principles, processes and 
concepts 


Certification functions 


Conducting the 
application review to 
determine audit team 

competence required, to 
select the audit team 
members, and to 
determine the audit time 


X (see 7.1) 


Reviewing audit 
reports and making 
certification decisions 


X (see 6.1) 


Auditing and leading 
the audit team 


X (see 5.2) 


Context of the organiza- 
tion 


X (see 7.2) 


X (see 6.2) 


X (see 5.3) 


Leadership, consulta- 
tion and participation of 
workers 


X (see 6.3) 


X (see 5.4) 


Legal requirements and 
other requirements 


X (See 6.4) 


X (see 5.5) 


OH&S risks, OH&S oppor- 
tunities and other risks 
and other opportunities 


X (see 6.5) 


X (see 5.6) 


Hazard identification 


X (See 6.5.1) 


X (see 5.6.2) 


Assessment of OH&S risks 


X (see 6.5.2) 


X (see 5.6.3) 


OH&S opportunities 


X (see 6.5.3) 


X (see 5.6.4) 


Emergency preparedness 
and response 


X (see 5.7) 


Performance evaluation 


X (see 6.6) 


X (see 5.8) 


Eliminating hazards and 
reducing OH&S risks 


X (see 6.7) 


X (see 5.9) 


ncidentinvestigation | | Ga) x fee 0 
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